[PULL 0/3] Hex queue

[PULL 0/3] Hex queue

[Brian Cain]

The following changes since commit 3e3ccab106f879b1512f8e0d51a827dd4de30e22:

  Update version for v11.1.0-rc3 release (2026-08-04 15:36:08 -0400)

are available in the Git repository at:

  https://github.com/qualcomm/qemu tags/hex-20260806-pull-request

for you to fetch changes up to 8f5bf4fa0aa2f5648f016b8265d86d4b05b42307:

  target/hexagon: don't let an idef-parser dest clobber its own source (2026-08-06 08:18:51 -0700)

----------------------------------------------------------------
hexagon: fix cmpy*(), same-slot packets

Fixes for these two bugs:
* short-circuited packets with `cmpy(Rs,Rt)` would get the wrong result
when Rs is the same register as Rt.
* some packets with slot constraints were incorrectly rejected as having
an invalid encoding/shuffle.

----------------------------------------------------------------

Brian Cain (3):
  target/hexagon: accept valid packets rejected by check
  tests/tcg/hexagon: add slot-assignment tests
  target/hexagon: don't let an idef-parser dest clobber its own source

 target/hexagon/genptr.h                |  1 +
 target/hexagon/decode.c                | 30 ++++++++---
 target/hexagon/genptr.c                | 11 ++++
 tests/tcg/hexagon/invalid-slots.c      | 72 ++++++++++++++++++++++++++
 tests/tcg/hexagon/read_write_overlap.c | 47 +++++++++++++++++
 tests/tcg/hexagon/valid-slots.c        | 62 ++++++++++++++++++++++
 target/hexagon/gen_tcg_funcs.py        | 15 ++++++
 target/hexagon/hex_common.py           | 12 +++++
 tests/tcg/hexagon/Makefile.target      |  1 +
 9 files changed, 243 insertions(+), 8 deletions(-)
 create mode 100644 tests/tcg/hexagon/valid-slots.c

-- 
2.34.1

[PULL 1/3] target/hexagon: accept valid packets rejected by check

[Brian Cain]

has_valid_slot_assignment() rejected any packet with two instructions
assigned to the same slot.  That is too strict.  When a memory
instruction is encoded before a slot-flexible instruction in a packet,
the descending slot assignment places the memory op in slot 1 and the
other in slot 0, then the "mem insns to slot 0" fixup moves the memory
op to slot 0 as well, leaving both in slot 0.  Such a packet is valid
and executes correctly, but the uniqueness test flagged it as
HEX_CAUSE_INVALID_PACKET, raising SIGILL in linux-user and a precise
exception in system mode.

For example this packet, with the load encoded first, was wrongly
rejected:

    { r6 = memw(r3+#-4)
      r7 = #0x4ae6 }

Replace the uniqueness test with a slot-exhaustion check: walk the
instructions in encoding order handing out slots in strictly decreasing
order and fail only if an instruction has no valid slot at or below the
running slot.  This accepts packets that legally share a slot while
still rejecting genuinely unassignable packets, such as a memory
instruction grouped with a duplex, or a load followed by an instruction
that requires a high slot.

Reviewed-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 target/hexagon/decode.c | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/target/hexagon/decode.c b/target/hexagon/decode.c
index 6eddcca26ed..e6bb7733be8 100644
--- a/target/hexagon/decode.c
+++ b/target/hexagon/decode.c
@@ -549,21 +549,35 @@ static bool decode_parsebits_is_loopend(uint32_t encoding32)
     return bits == 0x2;
 }
 
+/*
+ * Check that the packet's instructions can be grouped into slots: walk them
+ * in encoding order handing out slots in strictly decreasing order, and fail
+ * if an instruction has no valid slot at or below the running slot.  Two
+ * instructions may legally share a slot, so this does not require unique
+ * slots, only that every instruction fits.
+ */
 static bool has_valid_slot_assignment(Packet *pkt)
 {
-    int used_slots = 0;
-    for (int i = 0; i < pkt->num_insns; i++) {
-        int slot_mask;
-        Insn *insn = &pkt->insn[i];
-        if (decode_opcode_ends_loop(insn->opcode)) {
+    int i;
+    int slot = 3;
+
+    for (i = 0; i < pkt->num_insns; i++) {
+        SlotMask valid_slots;
+        if (decode_opcode_ends_loop(pkt->insn[i].opcode)) {
             /* We overload slot 0 for endloop. */
             continue;
         }
-        slot_mask = 1 << insn->slot;
-        if (used_slots & slot_mask) {
+        if (slot < 0) {
             return false;
         }
-        used_slots |= slot_mask;
+        valid_slots = get_valid_slots(pkt, i);
+        while (!(valid_slots & (1 << slot))) {
+            if (slot <= 0) {
+                return false;
+            }
+            slot--;
+        }
+        slot--;
     }
     return true;
 }
-- 
2.34.1

[PULL 2/3] tests/tcg/hexagon: add slot-assignment tests

[Brian Cain]

valid-slots: packets that legally share a slot and were wrongly
rejected before the fix (load and transfer, load encoded first;
dczeroa packed last with three transfers).

invalid-slots: unassignable packets that must still be rejected:
store + duplex, load + indirect jump, three logical ops competing for
slots 2 and 3, and five ops for four slots.

Reviewed-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 tests/tcg/hexagon/invalid-slots.c | 72 +++++++++++++++++++++++++++++++
 tests/tcg/hexagon/valid-slots.c   | 62 ++++++++++++++++++++++++++
 tests/tcg/hexagon/Makefile.target |  1 +
 3 files changed, 135 insertions(+)
 create mode 100644 tests/tcg/hexagon/valid-slots.c

diff --git a/tests/tcg/hexagon/invalid-slots.c b/tests/tcg/hexagon/invalid-slots.c
index 607027f314d..f2dace2e541 100644
--- a/tests/tcg/hexagon/invalid-slots.c
+++ b/tests/tcg/hexagon/invalid-slots.c
@@ -55,6 +55,75 @@ static int test_invalid_slots(void)
     return sig;
 }
 
+/* Load then indirect jump, load encoded first: no high slot left for jump. */
+static int test_invalid_slots_highslot(void)
+{
+    int sig;
+
+    asm volatile(
+        "r0 = #0\n"
+        "r1 = ##1f\n"
+        "memw(%1) = r1\n"
+        "r3 = #mem\n"
+        ".word 0x91834006\n" /* { r6 = memw(r3+#0); */
+        ".word 0x529fc000\n" /*   jumpr r31 }        */
+        "1:\n"
+        "%0 = r0\n"
+        : "=r"(sig)
+        : "r"(&resume_pc)
+        : "r0", "r1", "r3", "r6", "memory");
+
+    return sig;
+}
+
+/*
+ * Three predicate-logical ops: each is restricted to slots 2 and 3, so the
+ * fourth-and-fifth-slot-free packet still has only two slots for three ops.
+ * No change-of-flow is involved, so the only reason to reject it is the slot
+ * conflict.
+ */
+static int test_invalid_slots_crslot23(void)
+{
+    int sig;
+
+    asm volatile(
+        "r0 = #0\n"
+        "r1 = ##1f\n"
+        "memw(%1) = r1\n"
+        ".word 0x6b024100\n" /* { p0 = and(p1, p2); */
+        ".word 0x6b224103\n" /*   p3 = or(p1, p2);   */
+        ".word 0x6b42c301\n" /*   p1 = xor(p2, p3) } */
+        "1:\n"
+        "%0 = r0\n"
+        : "=r"(sig)
+        : "r"(&resume_pc)
+        : "r0", "r1", "p0", "p1", "p3", "memory");
+
+    return sig;
+}
+
+/* Three transfers plus a duplex: five ops for four slots. */
+static int test_invalid_slots_five(void)
+{
+    int sig;
+
+    asm volatile(
+        "r0 = #0\n"
+        "r1 = ##1f\n"
+        "memw(%1) = r1\n"
+        ".word 0x78004020\n" /* { r0 = #1;           */
+        ".word 0x78004041\n" /*   r1 = #2;            */
+        ".word 0x78004062\n" /*   r2 = #3;            */
+        ".word 0x28452856\n" /*   r5 = #4; r6 = #5 }  */
+        "1:\n"
+        "%0 = r0\n"
+        : "=r"(sig)
+        : "r"(&resume_pc)
+        : "r0", "r1", "r2", "r5", "r6", "memory");
+
+    return sig;
+}
+
 int main()
 {
     struct sigaction act;
@@ -65,6 +134,9 @@ int main()
     assert(sigaction(SIGILL, &act, NULL) == 0);
 
     assert(test_invalid_slots() == SIGILL);
+    assert(test_invalid_slots_highslot() == SIGILL);
+    assert(test_invalid_slots_crslot23() == SIGILL);
+    assert(test_invalid_slots_five() == SIGILL);
 
     puts("PASS");
     return EXIT_SUCCESS;
diff --git a/tests/tcg/hexagon/valid-slots.c b/tests/tcg/hexagon/valid-slots.c
new file mode 100644
index 00000000000..70d9b0b6acf
--- /dev/null
+++ b/tests/tcg/hexagon/valid-slots.c
@@ -0,0 +1,62 @@
+/*
+ * Regression tests for valid packets that qemu incorrectly rejected as
+ * invalid.
+ *
+ * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+
+int err;
+
+#include "hex_test.h"
+
+/* volatile to keep the load from being optimized away */
+static volatile int buf[2] = { 0x1234, 0 };
+
+/* Load and register transfer in one packet, load encoded first. */
+static int32_t load_imm_pair(void)
+{
+    int32_t out;
+    /* { r6 = memw(r3+#-4); r7 = #0x4ae6 } */
+    asm volatile(
+        "{ r3 = %1 }\n\t"
+        ".word 0x97837fe6\n\t"
+        ".word 0x7845dcc7\n\t"
+        "{ %0 = r6 }\n\t"
+        : "=r"(out) : "r"(&buf[1]) : "r3", "r6", "r7");
+    return out;
+}
+
+static int32_t dcbuf[8] __attribute__((aligned(32)));
+
+/* Slot-0-only op (dczeroa) packed last with three transfers. */
+static void slot0_restricted(int32_t *out)
+{
+    asm volatile(
+        "{ %0 = #0x11\n\t"
+        "  %1 = #0x22\n\t"
+        "  %2 = #0x33\n\t"
+        "  dczeroa(%3) }\n\t"
+        : "=r"(out[0]), "=r"(out[1]), "=r"(out[2])
+        : "r"(dcbuf) : "memory");
+}
+
+int main()
+{
+    int32_t r[3];
+
+    check32(load_imm_pair(), 0x1234);
+
+    dcbuf[0] = 0x5a5a5a5a;
+    slot0_restricted(r);
+    check32(r[0], 0x11);
+    check32(r[1], 0x22);
+    check32(r[2], 0x33);
+    check32(dcbuf[0], 0);       /* dczeroa cleared the line */
+
+    puts(err ? "FAIL" : "PASS");
+    return err;
+}
diff --git a/tests/tcg/hexagon/Makefile.target b/tests/tcg/hexagon/Makefile.target
index a2a0ffc69b2..80e56f7d055 100644
--- a/tests/tcg/hexagon/Makefile.target
+++ b/tests/tcg/hexagon/Makefile.target
@@ -51,6 +51,7 @@ HEX_TESTS += scatter_gather
 HEX_TESTS += hvx_misc
 HEX_TESTS += hvx_histogram
 HEX_TESTS += invalid-slots
+HEX_TESTS += valid-slots
 HEX_TESTS += invalid-encoding
 HEX_TESTS += multiple-writes
 HEX_TESTS += unaligned_pc
-- 
2.34.1

[PULL 3/3] target/hexagon: don't let an idef-parser dest clobber its own source

[Brian Cain]

The idef-parser emitters write the destination in place, so when a packet
is short-circuited and get_result_gpr() returns hex_gpr[] itself, an
instruction naming one register as both source and destination reads back
a value it already overwrote.

`Rd32=cmpy(Rs32,Rt32):<<1:rnd:sat` with Rs == Rd is an example.

Give a source reg that aliases a destination its own copy of the
register value.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 target/hexagon/genptr.h                |  1 +
 target/hexagon/genptr.c                | 11 ++++++
 tests/tcg/hexagon/read_write_overlap.c | 47 ++++++++++++++++++++++++++
 target/hexagon/gen_tcg_funcs.py        | 15 ++++++++
 target/hexagon/hex_common.py           | 12 +++++++
 5 files changed, 86 insertions(+)

diff --git a/target/hexagon/genptr.h b/target/hexagon/genptr.h
index 45ee038ca94..5d096774102 100644
--- a/target/hexagon/genptr.h
+++ b/target/hexagon/genptr.h
@@ -36,6 +36,7 @@ void gen_store8i(TCGv_env cpu_env, TCGv vaddr, int64_t src, uint32_t slot);
 TCGv gen_read_reg(TCGv result, int num);
 TCGv gen_read_preg(TCGv pred, uint8_t num);
 TCGv get_result_gpr(DisasContext *ctx, int rnum);
+TCGv gen_unalias_gpr_src(TCGv src, TCGv dst);
 TCGv get_result_pred(DisasContext *ctx, int pnum);
 void gen_pred_write(DisasContext *ctx, int pnum, TCGv val);
 void gen_set_usr_field(DisasContext *ctx, int field, TCGv val);
diff --git a/target/hexagon/genptr.c b/target/hexagon/genptr.c
index 3f310377097..12813f48bf9 100644
--- a/target/hexagon/genptr.c
+++ b/target/hexagon/genptr.c
@@ -91,6 +91,17 @@ TCGv get_result_gpr(DisasContext *ctx, int rnum)
     }
 }
 
+TCGv gen_unalias_gpr_src(TCGv src, TCGv dst)
+{
+    if (src != dst) {
+        return src;
+    }
+
+    TCGv tmp = tcg_temp_new();
+    tcg_gen_mov_tl(tmp, src);
+    return tmp;
+}
+
 static TCGv_i64 get_result_gpr_pair(DisasContext *ctx, int rnum)
 {
     TCGv_i64 result = tcg_temp_new_i64();
diff --git a/tests/tcg/hexagon/read_write_overlap.c b/tests/tcg/hexagon/read_write_overlap.c
index 95c54ccd63c..7eaf75f545a 100644
--- a/tests/tcg/hexagon/read_write_overlap.c
+++ b/tests/tcg/hexagon/read_write_overlap.c
@@ -115,12 +115,59 @@ static void test_swiz(void)
     check32(swiz(0x11223344), 0x44332211);
 }
 
+#define CMPY(NAME, ASM) \
+static inline uint32_t NAME##_rd_eq_rs(uint32_t x, uint32_t y) \
+{ \
+    uint32_t res; \
+    asm("r7 = %1\n\t" \
+        ASM("r7", "%2") "\n\t" \
+        "%0 = r7\n\t" \
+        : "=r"(res) : "r"(x), "r"(y) : "r7"); \
+    return res; \
+} \
+static inline uint32_t NAME##_rd_eq_rt(uint32_t x, uint32_t y) \
+{ \
+    uint32_t res; \
+    asm("r7 = %2\n\t" \
+        ASM("%1", "r7") "\n\t" \
+        "%0 = r7\n\t" \
+        : "=r"(res) : "r"(x), "r"(y) : "r7"); \
+    return res; \
+}
+
+#define CMPY_RND_SAT(RS, RT)     "r7 = cmpy(" RS "," RT "):rnd:sat"
+#define CMPY_S1_RND_SAT(RS, RT)  "r7 = cmpy(" RS "," RT "):<<1:rnd:sat"
+#define CMPYC_RND_SAT(RS, RT)    "r7 = cmpy(" RS "," RT "*):rnd:sat"
+#define CMPYC_S1_RND_SAT(RS, RT) "r7 = cmpy(" RS "," RT "*):<<1:rnd:sat"
+
+CMPY(cmpyrs_s0, CMPY_RND_SAT)
+CMPY(cmpyrs_s1, CMPY_S1_RND_SAT)
+CMPY(cmpyrsc_s0, CMPYC_RND_SAT)
+CMPY(cmpyrsc_s1, CMPYC_S1_RND_SAT)
+
+static void test_cmpy(void)
+{
+    check32(cmpyrs_s0_rd_eq_rs(0x32195ce2, 0xef862430), 0x011b105b);
+    check32(cmpyrs_s0_rd_eq_rt(0x32195ce2, 0xef862430), 0x011b105b);
+    check32(cmpyrs_s1_rd_eq_rs(0x32195ce2, 0xef862430), 0x023520b5);
+    check32(cmpyrs_s1_rd_eq_rt(0x32195ce2, 0xef862430), 0x023520b5);
+    check32(cmpyrsc_s0_rd_eq_rs(0x32195ce2, 0xef862430), 0x0d0f09e8);
+    check32(cmpyrsc_s0_rd_eq_rt(0x32195ce2, 0xef862430), 0x0d0f09e8);
+    check32(cmpyrsc_s1_rd_eq_rs(0x32195ce2, 0xef862430), 0x1a1f13d0);
+    check32(cmpyrsc_s1_rd_eq_rt(0x32195ce2, 0xef862430), 0x1a1f13d0);
+
+    /* Both halves saturate */
+    check32(cmpyrs_s1_rd_eq_rs(0x80008000, 0x80008000), 0x7fff0000);
+    check32(cmpyrsc_s1_rd_eq_rs(0x7fff8001, 0x80017fff), 0x00008000);
+}
+
 int main()
 {
     test_insert();
     test_insert_rp();
     test_asr_r_svw_trun();
     test_swiz();
+    test_cmpy();
 
     puts(err ? "FAIL" : "PASS");
     return err ? EXIT_FAILURE : EXIT_SUCCESS;
diff --git a/target/hexagon/gen_tcg_funcs.py b/target/hexagon/gen_tcg_funcs.py
index 6d5d99cee3a..43e68077495 100755
--- a/target/hexagon/gen_tcg_funcs.py
+++ b/target/hexagon/gen_tcg_funcs.py
@@ -75,6 +75,21 @@ def gen_tcg_func(f, tag, regs, imms):
         f.write(f"    int {hex_common.imm_name(immlett)} = insn->immed[{i}];\n")
 
     if hex_common.is_idef_parser_enabled(tag):
+        gpr_operands = [
+            hex_common.get_register(tag, regtype, regid)
+            for regtype, regid in regs
+            if hex_common.get_register(tag, regtype, regid).may_alias_gpr()
+        ]
+        dests = [reg for reg in gpr_operands if reg.is_written()]
+        for reg in gpr_operands:
+            if reg.is_written() or not reg.is_read():
+                continue
+            src = reg.reg_tcg()
+            for dest in dests:
+                f.write(hex_common.code_fmt(f"""\
+                    {src} = gen_unalias_gpr_src({src}, {dest.reg_tcg()});
+                """))
+
         declared = []
         ## Handle registers
         for regtype, regid in regs:
diff --git a/target/hexagon/hex_common.py b/target/hexagon/hex_common.py
index d91a653c3d4..09a025ba13e 100755
--- a/target/hexagon/hex_common.py
+++ b/target/hexagon/hex_common.py
@@ -388,6 +388,8 @@ def decl_reg_num(self, f, regno):
         """))
     def idef_arg(self, declared):
         declared.append(self.reg_tcg())
+    def may_alias_gpr(self):
+        return False
     def helper_arg(self):
         return HelperArg(
             self.helper_proto_type(),
@@ -495,6 +497,8 @@ def is_new(self):
         return False
 
 class GprDest(Register, Single, Dest):
+    def may_alias_gpr(self):
+        return True
     def decl_tcg(self, f, tag, regno):
         self.decl_reg_num(f, regno)
         f.write(code_fmt(f"""\
@@ -510,6 +514,8 @@ def analyze_write(self, f, tag, regno):
         """))
 
 class GprSource(Register, Single, OldSource):
+    def may_alias_gpr(self):
+        return True
     def decl_tcg(self, f, tag, regno):
         self.decl_reg_num(f, regno)
         f.write(code_fmt(f"""\
@@ -531,6 +537,8 @@ def analyze_read(self, f, regno):
         """))
 
 class GprReadWrite(Register, Single, ReadWrite):
+    def may_alias_gpr(self):
+        return True
     def decl_tcg(self, f, tag, regno):
         self.decl_reg_num(f, regno)
         f.write(code_fmt(f"""\
@@ -557,6 +565,8 @@ def analyze_write(self, f, tag, regno):
         """))
 
 class ControlDest(Register, Single, Dest):
+    def may_alias_gpr(self):
+        return True
     def decl_reg_num(self, f, regno):
         f.write(code_fmt(f"""\
             const int {self.reg_num} = insn->regno[{regno}]  + HEX_REG_SA0;
@@ -593,6 +603,8 @@ def analyze_read(self, f, regno):
         """))
 
 class ModifierSource(Register, Single, OldSource):
+    def may_alias_gpr(self):
+        return True
     def decl_reg_num(self, f, regno):
         f.write(code_fmt(f"""\
             const int {self.reg_num} = insn->regno[{regno}] + HEX_REG_M0;
-- 
2.34.1

Re: [PULL 0/3] Hex queue

[Stefan Hajnoczi]

On Thu, Aug 6, 2026 at 5:38 PM Brian Cain <brian.cain@oss.qualcomm.com> wrote:
>
> The following changes since commit 3e3ccab106f879b1512f8e0d51a827dd4de30e22:
>
>   Update version for v11.1.0-rc3 release (2026-08-04 15:36:08 -0400)
>
> are available in the Git repository at:
>
>   https://github.com/qualcomm/qemu tags/hex-20260806-pull-request
>
> for you to fetch changes up to 8f5bf4fa0aa2f5648f016b8265d86d4b05b42307:
>
>   target/hexagon: don't let an idef-parser dest clobber its own source (2026-08-06 08:18:51 -0700)
>
> ----------------------------------------------------------------
> hexagon: fix cmpy*(), same-slot packets
>
> Fixes for these two bugs:
> * short-circuited packets with `cmpy(Rs,Rt)` would get the wrong result
> when Rs is the same register as Rt.
> * some packets with slot constraints were incorrectly rejected as having
> an invalid encoding/shuffle.

Hi Brian,
Are these fixes critical for QEMU v11.1.0?

Once -rc3 is reached, only critical fixes are merged so that the
release converges. Critical fixes include regressions since the
previous release, high severity security fixes, and build fixes.

If they are not critical, I will merge them once QEMU v11.1.0 has been
released (it should happen within the next week or two) and the
-stable tree can pick them up.

Thanks,
Stefan

>
> ----------------------------------------------------------------
>
> Brian Cain (3):
>   target/hexagon: accept valid packets rejected by check
>   tests/tcg/hexagon: add slot-assignment tests
>   target/hexagon: don't let an idef-parser dest clobber its own source
>
>  target/hexagon/genptr.h                |  1 +
>  target/hexagon/decode.c                | 30 ++++++++---
>  target/hexagon/genptr.c                | 11 ++++
>  tests/tcg/hexagon/invalid-slots.c      | 72 ++++++++++++++++++++++++++
>  tests/tcg/hexagon/read_write_overlap.c | 47 +++++++++++++++++
>  tests/tcg/hexagon/valid-slots.c        | 62 ++++++++++++++++++++++
>  target/hexagon/gen_tcg_funcs.py        | 15 ++++++
>  target/hexagon/hex_common.py           | 12 +++++
>  tests/tcg/hexagon/Makefile.target      |  1 +
>  9 files changed, 243 insertions(+), 8 deletions(-)
>  create mode 100644 tests/tcg/hexagon/valid-slots.c
>
> --
> 2.34.1
>

Re: [PULL 0/3] Hex queue

[Brian Cain]

On Sun, Aug 9, 2026 at 8:01 AM Stefan Hajnoczi <stefanha@gmail.com> wrote:
>
> On Thu, Aug 6, 2026 at 5:38 PM Brian Cain <brian.cain@oss.qualcomm.com> wrote:
> >
> > The following changes since commit 3e3ccab106f879b1512f8e0d51a827dd4de30e22:
> >
> >   Update version for v11.1.0-rc3 release (2026-08-04 15:36:08 -0400)
> >
> > are available in the Git repository at:
> >
> >   https://github.com/qualcomm/qemu tags/hex-20260806-pull-request
> >
> > for you to fetch changes up to 8f5bf4fa0aa2f5648f016b8265d86d4b05b42307:
> >
> >   target/hexagon: don't let an idef-parser dest clobber its own source (2026-08-06 08:18:51 -0700)
> >
> > ----------------------------------------------------------------
> > hexagon: fix cmpy*(), same-slot packets
> >
> > Fixes for these two bugs:
> > * short-circuited packets with `cmpy(Rs,Rt)` would get the wrong result
> > when Rs is the same register as Rt.
> > * some packets with slot constraints were incorrectly rejected as having
> > an invalid encoding/shuffle.
>
> Hi Brian,
> Are these fixes critical for QEMU v11.1.0?
>
> Once -rc3 is reached, only critical fixes are merged so that the
> release converges. Critical fixes include regressions since the
> previous release, high severity security fixes, and build fixes.
>
> If they are not critical, I will merge them once QEMU v11.1.0 has been
> released (it should happen within the next week or two) and the
> -stable tree can pick them up.

Sorry - I misunderstood.  No - they're not recent regressions and can
land post-release.

Thanks!

>
> Thanks,
> Stefan
>
> >
> > ----------------------------------------------------------------
> >
> > Brian Cain (3):
> >   target/hexagon: accept valid packets rejected by check
> >   tests/tcg/hexagon: add slot-assignment tests
> >   target/hexagon: don't let an idef-parser dest clobber its own source
> >
> >  target/hexagon/genptr.h                |  1 +
> >  target/hexagon/decode.c                | 30 ++++++++---
> >  target/hexagon/genptr.c                | 11 ++++
> >  tests/tcg/hexagon/invalid-slots.c      | 72 ++++++++++++++++++++++++++
> >  tests/tcg/hexagon/read_write_overlap.c | 47 +++++++++++++++++
> >  tests/tcg/hexagon/valid-slots.c        | 62 ++++++++++++++++++++++
> >  target/hexagon/gen_tcg_funcs.py        | 15 ++++++
> >  target/hexagon/hex_common.py           | 12 +++++
> >  tests/tcg/hexagon/Makefile.target      |  1 +
> >  9 files changed, 243 insertions(+), 8 deletions(-)
> >  create mode 100644 tests/tcg/hexagon/valid-slots.c
> >
> > --
> > 2.34.1
> >

Re: [PULL 0/3] Hex queue

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.2 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PULL 0/3] Hex queue

[Michael Tokarev]

On 8/7/26 00:36, Brian Cain wrote:
> hexagon: fix cmpy*(), same-slot packets
> 
> Fixes for these two bugs:
> * short-circuited packets with `cmpy(Rs,Rt)` would get the wrong result
> when Rs is the same register as Rt.
> * some packets with slot constraints were incorrectly rejected as having
> an invalid encoding/shuffle.

> Brian Cain (3):
>    target/hexagon: accept valid packets rejected by check
>    tests/tcg/hexagon: add slot-assignment tests
>    target/hexagon: don't let an idef-parser dest clobber its own source

This pull request missed 11.1.0 release, I'm picking this up for
stable-11.1 branch.  Please let me know if I should not.

Thanks,

/mjt

[PULL 0/3] hex queue

[Brian Cain]

The following changes since commit 8e711856d7639cbffa51405f2cc2366e3d9e3a23:

  Merge tag 'hppa-fixes-for-v11-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2026-03-20 10:04:48 +0000)

are available in the Git repository at:

  https://github.com/quic/qemu tags/pull-hex-20260320

for you to fetch changes up to 1adf67b3c445f4060900440ea210e7a1e03042f5:

  tests/tcg/hexagon: add test for predicated .new branch LSB evaluation (2026-03-20 07:43:03 -0700)

----------------------------------------------------------------
Fix for J2_jumptnew{,pt} pred-reg misbehavior

----------------------------------------------------------------
Brian Cain (3):
      target/hexagon: fix J2_jumptnew/pt predicate check to use LSB
      target/hexagon: use TCG_COND_TSTEQ/TSTNE for predicate branches
      tests/tcg/hexagon: add test for predicated .new branch LSB evaluation

 target/hexagon/gen_tcg.h                 |  94 ++++-----
 target/hexagon/genptr.c                  |  32 ++-
 target/hexagon/translate.c               |   2 +-
 tests/tcg/hexagon/test_pnew_jump_loads.c | 341 +++++++++++++++++++++++++++++++
 tests/tcg/hexagon/Makefile.target        |   3 +
 5 files changed, 394 insertions(+), 78 deletions(-)
 create mode 100644 tests/tcg/hexagon/test_pnew_jump_loads.c

Re: [PULL 0/3] hex queue

[Peter Maydell]

On Fri, 20 Mar 2026 at 14:50, Brian Cain <brian.cain@oss.qualcomm.com> wrote:
>
> The following changes since commit 8e711856d7639cbffa51405f2cc2366e3d9e3a23:
>
>   Merge tag 'hppa-fixes-for-v11-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2026-03-20 10:04:48 +0000)
>
> are available in the Git repository at:
>
>   https://github.com/quic/qemu tags/pull-hex-20260320
>
> for you to fetch changes up to 1adf67b3c445f4060900440ea210e7a1e03042f5:
>
>   tests/tcg/hexagon: add test for predicated .new branch LSB evaluation (2026-03-20 07:43:03 -0700)
>
> ----------------------------------------------------------------
> Fix for J2_jumptnew{,pt} pred-reg misbehavior
>



Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.0
for any user-visible changes.

-- PMM